I'm fairly new to Track-It and have started to run inventories on select subnets to try and get a good understanding of the flow. I'm using only an IP range to discover assets. After the window to manage discovered assets comes up, all of my newly discovered assets have the same MAC. This MAC is owned by a Cisco switch that is in a different building and not even on the same subnet. I'm just wondering if anyone else has had a similar issue.

There was a known issue with certain routers or certain configurations but I do not know the exact details. If that continues to happen, we will need to get you over to tech support so they can help out. Have you tried discovering by Domain?

These types of errors are usually associated with incorrect setting with either SNMP or MIB.

Andrew - Check your SNMP setting to make sure they match the public SNMP settings on your network switches and routers.

Cris - Does Track-it use anything related to MIB to help discover MAC addresses? I use a program from SoftPerfect called Network Scanner that has a similar problem unless router SNMP MIB query is enabled.

We do not do anything like that as far as I am aware. It is a very basic scan meant to quickly find your devices and identify computers so you can then run the Track-It! Audit to capture more detailed information about those systems.

I just wanted to clarify exactly what I'm attempting to do. I'm trying to discover assets that are located in another building behind a firewall. I don't have any SNMP configurations set at Track-It states that this is optional. I simply have a range of IP addresses for that building. It does a scan and picks up a bunch of devices, buth the MAC is the same. When I trace this MAC through the network, it is located on a Cisco switch interface VLAN 65 in another building. Then I decided to scan devices in yet another building that has a firewall at the perimeter. These devices came back with the same MAC. At this point, I may try to pull down some packet captures with WireShark.

If this continues to be a problem, we will need to get you over to tech support to have a look. Sounds like for some reason the scan is not able to pass through the switch to retrieve the MAC addresses of the devices on the other segment.

Thanks for the posts. My WireShark packet capture shows that the polled devices are sending an ARP reply back to the Track-It server with the MAC address in question. Track-It is simply putting that MAC in the correct spot. Right now it doesn't seem to be a Track-It issue. I'll do some more digging on the network and keep the post going until resolved.

I have the same issue with a customer, and the answer given by support is essentially what Andrew describes on his Apr 13 9:07 answer.

For this customer, attempting to identify what device on their network is sending back the incorrect ARP reply is too complex to be practical, since they have a large, complicated network. in their case, only a few machines show the duplicate MAC address, not all of them.

Support sugested that the best solution is to push the audits through a login script for all auditable assets, ensuring that each asset communicates directly with the server, thus sending only the correct information.

This is also an impractical solution when you're talking about 500 or more auditable worsktations.

For the moment, this customer has decided to simply ignore the issue - but they're still annoyed that the MAC address that shows on the Grid List is not the correct one. They know that software like Panda, for example, is able to extract the correct hardware inventory information from all their machines without duplicating MAC addresses, so they figure it should be a matter of adjusting the method for extracting the information.

The ARP protocol is not routable so that is why Discovery cannot get the MAC address from the remote workstations across the router. It simply returns the MAC address of the router. This should generally not be a problem however, because when you remotely audit the machines later it doesn't call the MAC address. It simply calls the computer name and relies on DNS to tell it (by IP Address), which PC to communicate with. If you simply run audits via login script it would simply run the audit on the machine and send the audit results back to the server. In either case, after the audit data is merged into Inventory the hardware results (including the PC's actual MAC Address) will be updated in the existing Inventory record.

This is all true. The one aggravating detail is that the machines were originally included into the Inventory via Discovery, they will show the bogus router MAC address. When the audits are performed and merged, the real MAC address will show... as an additional MAC address. It will not update or displace the MAC address reported by Discovery. On the Inventory Grid View, the MAC address that shows is the original address reported by Discovery, not the real address reported by the Audit; you can only see this latter one by opening the Asset and checking the hardware information. While this is not a critical problem, it is an inconvenience because the grid view shows a bunch of machines all with the same MAC addreses.

I see. Thank you. I didn't realize that the MAC Address in the Inventory grid view would still show the original one. I'll make sure we report this.

Thanks.

[UPDATE]

I just tried to replicate the issue and couldn't in my test. I initially transferred my Discovered asset from Discovery into Inventory, then went into the database and set the MAC Address to be something completely different (to simulate that it came in with an incorrect MAC address). I then audited the machine and merged it in and the MAC address was updated in my Inventory grid view as expected.